@jini-ai/admin 0.4.12 → 0.4.13

package/dist/security/controllers/root-key.controller.js

@@ -1,10 +1,16 @@
 import { createControllerStore } from '../../core/module/controller-store.js';
 import { ROOT_KEY_PERMISSION, START_FRESH_CONFIRMATION, isRootKeyLocked } from '../rules.js';
+/** Receivers named in a result need their new signing secret; the message tells the operator which ones. */
+function resultMessage({ result, response }, _optional = {}) {
+    const hooks = response.affectedWebhooks;
+    return hooks?.length ? `${result} Update receivers: ${hooks.map(w => `${w.label} (${w.targetUrl})`).join(', ')}` : result;
+}
 export function createRootKeyController({ api, permissions = [] }, _optional = {}) {
     const granted = permissions.includes(ROOT_KEY_PERMISSION);
     const store = createControllerStore({ initial: { status: null, preview: null, token: '', confirm: '', loading: false, saving: false, error: null, result: null, confirming: false } });
     let generation = 0;
     const allowed = () => granted && !store.signal.aborted;
+    const canPreview = () => { const state = store.getSnapshot(); return allowed() && isRootKeyLocked({ status: state.status }) && !state.saving && !state.loading; };
     async function load(_required, _optional = {}) {
         if (!allowed())
             return;
@@ -28,19 +34,20 @@ export function createRootKeyController({ api, permissions = [] }, _optional = {
         if (!allowed() || store.getSnapshot().saving)
             return false;
         store.set({ patch: { saving: true, error: null } });
+        let ok = false;
         try {
             const response = await run();
-            store.set({ patch: { token: '', confirm: '', preview: null, confirming: false, result: response.affectedWebhooks?.length ? `${result} Update receivers: ${response.affectedWebhooks.map(w => `${w.label} (${w.targetUrl})`).join(', ')}` : result } });
+            store.set({ patch: { token: '', confirm: '', preview: null, confirming: false, result: resultMessage({ result, response }) } });
             await load({});
-            return !store.signal.aborted;
+            ok = !store.signal.aborted;
         }
         catch {
             store.set({ patch: { error: 'Recovery refused. Check the host key configuration.' } });
-            return false;
         }
         finally {
             store.set({ patch: { saving: false } });
         }
+        return ok;
     }
     return {
         getSnapshot: store.getSnapshot, subscribe: store.subscribe, load,
@@ -57,26 +64,27 @@ export function createRootKeyController({ api, permissions = [] }, _optional = {
         },
         importToken(_required, _optional = {}) { const token = store.getSnapshot().token.trim(); return token && isRootKeyLocked({ status: store.getSnapshot().status }) ? execute(() => api.importToken({ token }, { signal: store.signal }), 'Unlocked. Saved credentials work again.') : Promise.resolve(false); },
         async preview(_required, _optional = {}) {
-            if (!allowed() || !isRootKeyLocked({ status: store.getSnapshot().status }) || store.getSnapshot().saving || store.getSnapshot().loading)
+            if (!canPreview())
                 return false;
             const ticket = ++generation;
             store.set({ patch: { loading: true, preview: null, confirm: '', error: null } });
+            let ok = false;
             try {
                 const preview = await api.previewStartFresh({}, { signal: store.signal });
-                if (ticket !== generation || !allowed())
-                    return false;
-                store.set({ patch: { preview, confirming: true } });
-                return true;
+                if (ticket === generation && allowed()) {
+                    store.set({ patch: { preview, confirming: true } });
+                    ok = true;
+                }
             }
             catch {
                 if (ticket === generation)
                     store.set({ patch: { error: 'Recovery preview unavailable' } });
-                return false;
             }
             finally {
                 if (ticket === generation)
                     store.set({ patch: { loading: false } });
             }
+            return ok;
         },
         startFresh(_required, _optional = {}) { const state = store.getSnapshot(); if (!isRootKeyLocked({ status: state.status }) || !state.preview || !state.confirming || state.confirm !== START_FRESH_CONFIRMATION)
             return Promise.resolve(false); return execute(() => api.startFresh({ confirm: state.confirm }, { signal: store.signal }), 'Done. Re-enter removed credentials.'); },

package/dist/security/react/hooks/AccessTokensTab.hooks.d.ts

@@ -1,44 +1,11 @@
 import type { TabViewProps } from '../../../core/react/bind-react.js';
 import type { CredentialSummary, OtherCredentialSummary, CredentialCategory } from '../../models.js';
+type Removal = {
+    row: CredentialSummary | OtherCredentialSummary;
+    type: 'access' | 'other';
+};
 export declare function useAccessTokensTab({ permissions }: TabViewProps, _optional?: {}): {
-    denied: boolean;
-    loading: boolean;
-    saving: boolean;
-    rows: {
-        row: CredentialSummary;
-        label: string;
-        canWrite: boolean;
-        edit(): void;
-        remove(): void;
-        makeDefault(): void;
-    }[];
-    otherRows: {
-        row: OtherCredentialSummary;
-        canWrite: boolean;
-        token: string;
-        onToken({ value }: {
-            value: string;
-        }): void;
-        replace(): void;
-        remove(): void;
-    }[];
-    providers: {
-        provider: import("../../models.js").CredentialProvider;
-        canWrite: boolean;
-        add(): void;
-    }[];
-    categories: readonly {
-        value: CredentialCategory | "all";
-        label: string;
-    }[];
-    query: string;
-    category: "all" | CredentialCategory;
-    total: number;
-    matched: number;
-    removal: {
-        row: CredentialSummary | OtherCredentialSummary;
-        type: "access" | "other";
-    } | null;
+    removal: Removal | null;
     draft: import("../../models.js").CredentialDraft | null;
     errors: string[];
     canAddCustom: boolean;
@@ -90,5 +57,40 @@ export declare function useAccessTokensTab({ permissions }: TabViewProps, _optio
         }, _optional?: {}): Promise<boolean>;
         dispose(_required?: Record<string, never>, _optional?: {}): void;
     } | null;
+    total: number;
+    matched: number;
+    rows: {
+        row: CredentialSummary;
+        label: string;
+        canWrite: boolean;
+        edit(): void;
+        remove(): void;
+        makeDefault(): void;
+    }[];
+    otherRows: {
+        row: OtherCredentialSummary;
+        canWrite: boolean;
+        token: string;
+        onToken({ value }: {
+            value: string;
+        }): void;
+        replace(): void;
+        remove(): void;
+    }[];
+    providers: {
+        provider: import("../../models.js").CredentialProvider;
+        canWrite: boolean;
+        add(): void;
+    }[];
+    categories: readonly {
+        value: CredentialCategory | "all";
+        label: string;
+    }[];
+    query: string;
+    category: "all" | CredentialCategory;
+    loading: boolean;
+    saving: boolean;
+    denied: boolean;
 };
+export {};
 //# sourceMappingURL=AccessTokensTab.hooks.d.ts.map

package/dist/security/react/hooks/AccessTokensTab.hooks.js

@@ -4,6 +4,35 @@ import { createAccessTokensController } from '../../controllers/access-tokens.co
 import { createOtherCredentialsController } from '../../controllers/other-credentials.controller.js';
 import { CATEGORIES, credentialLabel, filterCredentials, filterOtherCredentials, otherWritePermission, writePermission } from '../../rules.js';
 import { noOtherCredentials, useSecurityPorts } from './SecurityPorts.hooks.js';
+function currentFilter({ snapshot: s }, _optional = {}) { return { query: s?.query ?? '', category: s?.category ?? 'all' }; }
+function accessRows({ snapshot: s, controller, scope }, _optional = {}) {
+    if (!s)
+        return [];
+    const { permissions, query, category, setRemoval } = scope;
+    return filterCredentials({ rows: s.rows, providers: s.providers, query, category }).map(row => ({ row, label: credentialLabel({ row, providers: s.providers }), canWrite: permissions.includes(writePermission({ kind: row.kind })), edit() { controller?.begin({ row }); }, remove() { setRemoval({ row, type: 'access' }); }, makeDefault() { void controller?.makeDefault({ row }); } }));
+}
+function otherRowsView({ snapshot: o, controller, scope }, _optional = {}) {
+    if (!o)
+        return [];
+    const { permissions, query, category, setRemoval } = scope;
+    return filterOtherCredentials({ rows: o.rows, query, category }).map(row => ({ row, canWrite: permissions.includes(otherWritePermission({ store: row.store })), token: o.drafts[`${row.store}:${row.id}`] ?? '', onToken({ value }) { controller?.setDraft({ key: `${row.store}:${row.id}`, token: value }); }, replace() { void controller?.replace({ row }); }, remove() { setRemoval({ row, type: 'other' }); } }));
+}
+function providerOptions({ snapshot: s, controller, scope }, _optional = {}) {
+    const { permissions, query, category } = scope;
+    return (s?.providers ?? []).filter(p => (category === 'all' || p.category === category) && `${p.label} ${p.id}`.toLowerCase().includes(query.trim().toLowerCase())).map(provider => ({ provider, canWrite: permissions.includes(writePermission({ kind: provider.kind })), add() { controller?.begin({ kind: provider.kind, providerId: provider.id }); } }));
+}
+function tokenCounts({ access: s, other: o, query }, _optional = {}) {
+    // Count remains global across categories; the search count answers how many saved tokens this host holds.
+    const total = (s?.rows.length ?? 0) + (o?.rows.length ?? 0);
+    const matched = (s ? filterCredentials({ rows: s.rows, providers: s.providers, query, category: 'all' }).length : 0) + (o ? filterOtherCredentials({ rows: o.rows, query, category: 'all' }).length : 0);
+    return { total, matched };
+}
+function tabStatus({ access: s, other: o }, _optional = {}) {
+    return { loading: s?.loading ?? true, saving: (s?.saving ?? false) || (o?.saving ?? false) };
+}
+function errorList({ access: s, other: o }, _optional = {}) {
+    return [...(s?.error ? [s.error] : []), ...Object.values(s?.errors ?? {}), ...Object.values(o?.errors ?? {})];
+}
 export function useAccessTokensTab({ permissions = [] }, _optional = {}) {
     const ports = useSecurityPorts({});
     const key = permissions.join('\0');
@@ -12,15 +41,13 @@ export function useAccessTokensTab({ permissions = [] }, _optional = {}) {
     const other = useController({ create: () => createOtherCredentialsController({ api: ports.otherCredentials ?? noOtherCredentials, permissions }), dependencies: [ports.otherCredentials, key] }, { start: ({ controller }) => { void controller.load({}); } });
     const [removal, setRemoval] = useState(null);
     const s = access.snapshot, o = other.snapshot;
-    const query = s?.query ?? '', category = s?.category ?? 'all';
-    const rows = s ? filterCredentials({ rows: s.rows, providers: s.providers, query, category }).map(row => ({ row, label: credentialLabel({ row, providers: s.providers }), canWrite: permissions.includes(writePermission({ kind: row.kind })), edit() { access.controller?.begin({ row }); }, remove() { setRemoval({ row, type: 'access' }); }, makeDefault() { void access.controller?.makeDefault({ row }); } })) : [];
-    const otherRows = o ? filterOtherCredentials({ rows: o.rows, query, category }).map(row => ({ row, canWrite: permissions.includes(otherWritePermission({ store: row.store })), token: o.drafts[`${row.store}:${row.id}`] ?? '', onToken({ value }) { other.controller?.setDraft({ key: `${row.store}:${row.id}`, token: value }); }, replace() { void other.controller?.replace({ row }); }, remove() { setRemoval({ row, type: 'other' }); } })) : [];
-    const providers = (s?.providers ?? []).filter(p => (category === 'all' || p.category === category) && `${p.label} ${p.id}`.toLowerCase().includes(query.trim().toLowerCase())).map(provider => ({ provider, canWrite: permissions.includes(writePermission({ kind: provider.kind })), add() { access.controller?.begin({ kind: provider.kind, providerId: provider.id }); } }));
-    // Count remains global across categories; the search count answers how many saved tokens this host holds.
-    const total = (s?.rows.length ?? 0) + (o?.rows.length ?? 0);
-    const matched = (s ? filterCredentials({ rows: s.rows, providers: s.providers, query, category: 'all' }).length : 0) + (o ? filterOtherCredentials({ rows: o.rows, query, category: 'all' }).length : 0);
-    return { denied: !canRead, loading: s?.loading ?? true, saving: (s?.saving ?? false) || (o?.saving ?? false), rows, otherRows, providers, categories: CATEGORIES, query, category, total, matched, removal,
-        draft: s?.draft ?? null, errors: [...(s?.error ? [s.error] : []), ...Object.values(s?.errors ?? {}), ...Object.values(o?.errors ?? {})],
+    const { query, category } = currentFilter({ snapshot: s });
+    const scope = { permissions, query, category, setRemoval };
+    const rows = accessRows({ snapshot: s, controller: access.controller, scope });
+    const otherRows = otherRowsView({ snapshot: o, controller: other.controller, scope });
+    const providers = providerOptions({ snapshot: s, controller: access.controller, scope });
+    return { denied: !canRead, ...tabStatus({ access: s, other: o }), rows, otherRows, providers, categories: CATEGORIES, query, category, ...tokenCounts({ access: s, other: o, query }), removal,
+        draft: s?.draft ?? null, errors: errorList({ access: s, other: o }),
         canAddCustom: permissions.includes('custom-credentials.write'),
         addCustom() { access.controller?.begin({ kind: 'custom' }); },
         onQuery({ value }) { access.controller?.filter({ query: value }); },

package/dist/security/react/hooks/RootKeyTab.hooks.d.ts

@@ -1,19 +1,5 @@
 import type { TabViewProps } from '../../../core/react/bind-react.js';
 export declare function useRootKeyTab({ permissions, params }: TabViewProps, _optional?: {}): {
-    denied: boolean;
-    loading: boolean;
-    saving: boolean;
-    status: import("../../models.js").RootKeyStatus | null | undefined;
-    error: string | null | undefined;
-    result: string | null | undefined;
-    scopeNotice: string;
-    token: string;
-    confirm: string;
-    confirming: boolean;
-    preview: import("../../models.js").RootKeyPreview | null | undefined;
-    locked: boolean;
-    canGenerate: boolean;
-    canConfirm: boolean;
     onToken({ value }: {
         value: string;
     }): void;
@@ -25,5 +11,19 @@ export declare function useRootKeyTab({ permissions, params }: TabViewProps, _op
     previewFresh(): void;
     cancelFresh(): void;
     confirmFresh(): Promise<void>;
+    locked: boolean;
+    canGenerate: boolean;
+    canConfirm: boolean;
+    token: string;
+    confirm: string;
+    confirming: boolean;
+    preview: import("../../models.js").RootKeyPreview | null | undefined;
+    scopeNotice: string;
+    loading: boolean;
+    saving: boolean;
+    status: import("../../models.js").RootKeyStatus | null | undefined;
+    error: string | null | undefined;
+    result: string | null | undefined;
+    denied: boolean;
 };
 //# sourceMappingURL=RootKeyTab.hooks.d.ts.map

package/dist/security/react/hooks/RootKeyTab.hooks.js

@@ -2,14 +2,23 @@ import { useController } from '../../../core/react/use-controller.js';
 import { createRootKeyController } from '../../controllers/root-key.controller.js';
 import { ROOT_KEY_PERMISSION, START_FRESH_CONFIRMATION, isRootKeyLocked } from '../../rules.js';
 import { unavailableRootKey, useSecurityPorts } from './SecurityPorts.hooks.js';
+/** Before the controller exists the tab reads as loading with nothing known yet. */
+function rootKeyProgress({ snapshot: s }, _optional = {}) {
+    return { loading: s?.loading ?? true, saving: s?.saving ?? false, status: s?.status, error: s?.error, result: s?.result };
+}
+function rootKeyInputs({ snapshot: s }, _optional = {}) {
+    return { token: s?.token ?? '', confirm: s?.confirm ?? '', confirming: s?.confirming ?? false, preview: s?.preview };
+}
+function rootKeyFlags({ snapshot: s }, _optional = {}) {
+    return { locked: isRootKeyLocked({ status: s?.status ?? null }), canGenerate: s?.status?.state === 'missing' && !s.status.active, canConfirm: !!s?.preview && s.confirm === START_FRESH_CONFIRMATION };
+}
 export function useRootKeyTab({ permissions = [], params }, _optional = {}) {
     const { rootKey } = useSecurityPorts({});
     const key = permissions.join('\0');
     const { controller, snapshot: s } = useController({ create: () => createRootKeyController({ api: rootKey ?? unavailableRootKey, permissions }), dependencies: [rootKey, key] }, { start: ({ controller }) => { void controller.load({}); } });
-    return { denied: !rootKey || !permissions.includes(ROOT_KEY_PERMISSION), loading: s?.loading ?? true, saving: s?.saving ?? false, status: s?.status, error: s?.error, result: s?.result,
+    return { denied: !rootKey || !permissions.includes(ROOT_KEY_PERMISSION), ...rootKeyProgress({ snapshot: s }),
         scopeNotice: typeof params.scopeNotice === 'string' ? params.scopeNotice : 'This key protects saved credentials. Keep its backup separate from the database.',
-        token: s?.token ?? '', confirm: s?.confirm ?? '', confirming: s?.confirming ?? false, preview: s?.preview,
-        locked: isRootKeyLocked({ status: s?.status ?? null }), canGenerate: s?.status?.state === 'missing' && !s.status.active, canConfirm: !!s?.preview && s.confirm === START_FRESH_CONFIRMATION,
+        ...rootKeyInputs({ snapshot: s }), ...rootKeyFlags({ snapshot: s }),
         onToken({ value }) { controller?.setToken({ value }); }, onConfirmText({ value }) { controller?.setConfirm({ value }); },
         generate() { void controller?.generate({}); }, unlock() { void controller?.importToken({}); }, previewFresh() { void controller?.preview({}); },
         cancelFresh() { controller?.cancel({}); }, async confirmFresh() { if (!await controller?.startFresh({}))

package/dist/security/react/tabs/RootKeyTab.d.ts

@@ -1,4 +1,4 @@
 import type { TabViewProps } from '../../../core/react/bind-react.js';
-export declare function RootKeyTab(props: TabViewProps, _optional?: {}): import("react").JSX.Element;
+export declare function RootKeyTab(props: TabViewProps): import("react").JSX.Element;
 export default RootKeyTab;
 //# sourceMappingURL=RootKeyTab.d.ts.map

package/dist/security/react/tabs/RootKeyTab.js

@@ -1,9 +1,18 @@
-import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
 import { Button, TextField, Notice, ConfirmDialog, Spinner } from '@jini-ai/ui-kit/react';
 import { useRootKeyTab } from '../hooks/RootKeyTab.hooks.js';
-export function RootKeyTab(props, _optional = {}) {
+function RootKeyMessages({ vm }) {
+    return _jsxs(_Fragment, { children: [vm.loading && _jsx(Spinner, { label: "Loading root key status\u2026" }), vm.error && _jsx(Notice, { tone: "danger", children: vm.error }), vm.result && _jsx(Notice, { tone: "success", children: vm.result })] });
+}
+function LockedActions({ vm }) {
+    return _jsxs(_Fragment, { children: [_jsx(TextField, { label: "Old root key", type: "password", value: vm.token, onValueChange: vm.onToken, disabled: vm.saving, attrs: { 'data-agent-private': 'true' } }), _jsx(Button, { onPress: vm.unlock, pending: vm.saving, children: "Unlock saved credentials" }), _jsx(Button, { onPress: vm.previewFresh, disabled: vm.saving || vm.loading, children: "Start fresh" })] });
+}
+function StartFreshBody({ vm }) {
+    return _jsxs(_Fragment, { children: [_jsx("p", { children: vm.preview?.detail }), _jsxs("p", { children: [vm.preview?.removes, " credentials will be removed."] }), vm.preview?.affectedWebhooks.map(w => _jsxs("p", { children: [w.label, " \u00B7 ", w.targetUrl] }, `${w.label}:${w.targetUrl}`)), _jsx(TextField, { label: "Type START FRESH", value: vm.confirm, onValueChange: vm.onConfirmText, disabled: vm.saving })] });
+}
+export function RootKeyTab(props) {
     const vm = useRootKeyTab(props);
-    return vm.denied ? _jsx(Notice, { tone: "danger", children: "Permission denied" }) : _jsxs("section", { "aria-label": "Root key", children: [_jsx(Notice, { children: vm.scopeNotice }), vm.loading && _jsx(Spinner, { label: "Loading root key status\u2026" }), vm.error && _jsx(Notice, { tone: "danger", children: vm.error }), vm.result && _jsx(Notice, { tone: "success", children: vm.result }), vm.status && _jsxs("p", { children: [vm.status.state, " \u00B7 ", vm.status.fingerprint, " \u00B7 ", vm.status.source] }), vm.canGenerate && _jsx(Button, { onPress: vm.generate, pending: vm.saving, children: "Create root key" }), vm.locked && _jsxs(_Fragment, { children: [_jsx(TextField, { label: "Old root key", type: "password", value: vm.token, onValueChange: vm.onToken, disabled: vm.saving, attrs: { 'data-agent-private': 'true' } }), _jsx(Button, { onPress: vm.unlock, pending: vm.saving, children: "Unlock saved credentials" }), _jsx(Button, { onPress: vm.previewFresh, disabled: vm.saving || vm.loading, children: "Start fresh" })] }), vm.confirming && _jsx(ConfirmDialog, { open: true, title: "Start fresh", body: _jsxs(_Fragment, { children: [_jsx("p", { children: vm.preview?.detail }), _jsxs("p", { children: [vm.preview?.removes, " credentials will be removed."] }), vm.preview?.affectedWebhooks.map(w => _jsxs("p", { children: [w.label, " \u00B7 ", w.targetUrl] }, `${w.label}:${w.targetUrl}`)), _jsx(TextField, { label: "Type START FRESH", value: vm.confirm, onValueChange: vm.onConfirmText, disabled: vm.saving })] }), consequence: "Saved credentials will be removed. Update affected webhook receivers with new signing secrets.", confirmLabel: "Start fresh", onConfirm: vm.confirmFresh, onCancel: vm.cancelFresh, pending: vm.saving, agentMayConfirm: false, tone: "danger" })] });
+    return vm.denied ? _jsx(Notice, { tone: "danger", children: "Permission denied" }) : _jsxs("section", { "aria-label": "Root key", children: [_jsx(Notice, { children: vm.scopeNotice }), _jsx(RootKeyMessages, { vm: vm }), vm.status && _jsxs("p", { children: [vm.status.state, " \u00B7 ", vm.status.fingerprint, " \u00B7 ", vm.status.source] }), vm.canGenerate && _jsx(Button, { onPress: vm.generate, pending: vm.saving, children: "Create root key" }), vm.locked && _jsx(LockedActions, { vm: vm }), vm.confirming && _jsx(ConfirmDialog, { open: true, title: "Start fresh", body: _jsx(StartFreshBody, { vm: vm }), consequence: "Saved credentials will be removed. Update affected webhook receivers with new signing secrets.", confirmLabel: "Start fresh", onConfirm: vm.confirmFresh, onCancel: vm.cancelFresh, pending: vm.saving, agentMayConfirm: false, tone: "danger" })] });
 }
 export default RootKeyTab;
 //# sourceMappingURL=RootKeyTab.js.map

package/dist/security/rules.js

@@ -9,8 +9,9 @@ export const OTHER_STORES = ['site-assistant', 'admin-byok', 'media-provider', '
 export function writePermission({ kind }, _optional = {}) { return kind === 'custom' ? 'custom-credentials.write' : kind === 'publish' ? 'system.publish' : 'source-control.credentials.write'; }
 export function otherWritePermission({ store }, _optional = {}) { return store === 'site-assistant' || store === 'admin-byok' ? 'admin.assistant.manage' : 'admin.integrations.manage'; }
 export function credentialStore({ api, kind }, _optional = {}) { return kind === 'source-control' ? api.sourceControl : kind === 'publish' ? api.publish : api.custom; }
+function defaultCategory({ kind }, _optional = {}) { return kind === 'publish' ? 'hosting' : kind === 'source-control' ? 'source-control' : 'general'; }
 export function blankCredentialDraft({ kind, providerId = '' }, _optional = {}) {
-    return { kind, providerId, label: '', token: '', values: {}, category: kind === 'publish' ? 'hosting' : kind === 'source-control' ? 'source-control' : 'general', baseUrl: '', additionalHosts: '', username: '' };
+    return { kind, providerId, label: '', token: '', values: {}, category: defaultCategory({ kind }), baseUrl: '', additionalHosts: '', username: '' };
 }
 /** Legacy sentinel labels are display-only: opening this page must never mutate saved data. */
 export function credentialLabel({ row, providers }, _optional = {}) {
@@ -18,46 +19,65 @@ export function credentialLabel({ row, providers }, _optional = {}) {
         return row.label;
     return `${providers.find(p => p.kind === row.kind && p.id === row.providerId)?.label ?? row.providerId} token`;
 }
-export function credentialCategory({ row }, _optional = {}) { return row.category ?? (row.kind === 'publish' ? 'hosting' : row.kind === 'source-control' ? 'source-control' : 'general'); }
+export function credentialCategory({ row }, _optional = {}) { return row.category ?? defaultCategory({ kind: row.kind }); }
 export function filterCredentials({ rows, query, category, providers }, _optional = {}) {
     const q = query.trim().toLowerCase();
     return rows.filter(row => (category === 'all' || credentialCategory({ row }) === category) && [credentialLabel({ row, providers }), row.providerId, row.baseUrl ?? '', row.accountLabel ?? ''].join(' ').toLowerCase().includes(q));
 }
 export function filterOtherCredentials({ rows, query, category }, _optional = {}) { return rows.filter(row => (category === 'all' || row.category === category) && `${row.label} ${row.store}`.toLowerCase().includes(query.trim().toLowerCase())); }
+function findProvider({ draft, providers }, _optional = {}) { return providers.find(p => p.kind === draft.kind && p.id === draft.providerId); }
+function isDuplicateLabel({ draft, rows }, _optional = {}) {
+    const label = draft.label.trim().toLowerCase();
+    return rows.some(r => r.kind === draft.kind && r.id !== draft.id && (draft.kind === 'custom' || r.providerId === draft.providerId) && r.label.trim().toLowerCase() === label);
+}
+function customDraftError({ draft }, _optional = {}) {
+    try {
+        if (!['http:', 'https:'].includes(new URL(draft.baseUrl).protocol))
+            return 'Enter an HTTP or HTTPS URL';
+    }
+    catch {
+        return 'Enter an HTTP or HTTPS URL';
+    }
+    return null;
+}
+function providerDraftError({ draft, providers }, _optional = {}) {
+    if (draft.id && !draft.token.trim())
+        return null;
+    const provider = findProvider({ draft, providers });
+    if (!provider)
+        return 'Provider is unavailable';
+    if (provider.fields.some(f => f.name !== provider.tokenField && f.required && !draft.values[f.name]?.trim()))
+        return 'Complete all required fields';
+    return null;
+}
 /** A custom row is its own provider identity; its username can change without retyping its token. */
 export function validateCredentialDraft({ draft, rows, providers }, _optional = {}) {
     if (!draft.label.trim())
         return 'Enter a name';
-    if (rows.some(r => r.kind === draft.kind && r.id !== draft.id && (draft.kind === 'custom' || r.providerId === draft.providerId) && r.label.trim().toLowerCase() === draft.label.trim().toLowerCase()))
+    if (isDuplicateLabel({ draft, rows }))
         return 'That name is already in use';
     if (!draft.id && !draft.token.trim())
         return 'Enter an access token';
-    if (draft.kind === 'custom') {
-        try {
-            if (!['http:', 'https:'].includes(new URL(draft.baseUrl).protocol))
-                return 'Enter an HTTP or HTTPS URL';
-        }
-        catch {
-            return 'Enter an HTTP or HTTPS URL';
-        }
-    }
-    else if (!draft.id || draft.token.trim()) {
-        const provider = providers.find(p => p.kind === draft.kind && p.id === draft.providerId);
-        if (!provider)
-            return 'Provider is unavailable';
-        if (provider.fields.some(f => f.name !== provider.tokenField && f.required && !draft.values[f.name]?.trim()))
-            return 'Complete all required fields';
-    }
-    return null;
+    return draft.kind === 'custom' ? customDraftError({ draft }) : providerDraftError({ draft, providers });
+}
+function customConnection({ draft, token }, _optional = {}) {
+    const username = draft.username.trim();
+    return { token, ...(username ? { username } : {}) };
+}
+function providerConnection({ draft, token, providers }, _optional = {}) {
+    const provider = findProvider({ draft, providers });
+    const extras = provider ? provider.fields.filter(f => f.name !== provider.tokenField && draft.values[f.name]?.trim()).map(f => [f.name, draft.values[f.name].trim()]) : [];
+    return { providerId: draft.providerId, [provider?.tokenField ?? 'token']: token, ...Object.fromEntries(extras) };
+}
+function customPatchFields({ draft }, _optional = {}) {
+    return { category: draft.category, baseUrl: draft.baseUrl.trim(), additionalHosts: draft.additionalHosts.split(/[\n,]/).map(s => s.trim()).filter(Boolean), username: draft.username.trim() || null };
 }
 /** Omitting connection preserves the saved secret. Never send an empty or half-blank replacement. */
 export function buildCredentialPatch({ draft, providers }, _optional = {}) {
-    const provider = providers.find(p => p.kind === draft.kind && p.id === draft.providerId);
     const token = draft.token.trim();
-    const connection = token ? draft.kind === 'custom'
-        ? { token, ...(draft.username.trim() ? { username: draft.username.trim() } : {}) }
-        : { providerId: draft.providerId, [provider?.tokenField ?? 'token']: token, ...Object.fromEntries((provider?.fields ?? []).filter(f => f.name !== provider?.tokenField && draft.values[f.name]?.trim()).map(f => [f.name, draft.values[f.name].trim()])) } : undefined;
-    return { label: draft.label.trim(), ...(connection ? { connection } : {}), ...(draft.kind === 'custom' ? { category: draft.category, baseUrl: draft.baseUrl.trim(), additionalHosts: draft.additionalHosts.split(/[\n,]/).map(s => s.trim()).filter(Boolean), username: draft.username.trim() || null } : {}) };
+    const custom = draft.kind === 'custom';
+    const connection = token ? (custom ? customConnection({ draft, token }) : providerConnection({ draft, token, providers })) : undefined;
+    return { label: draft.label.trim(), ...(connection ? { connection } : {}), ...(custom ? customPatchFields({ draft }) : {}) };
 }
 export function isRootKeyLocked({ status }, _optional = {}) { return status?.state === 'missing-with-data' || status?.state === 'mismatch'; }
 //# sourceMappingURL=rules.js.map

package/dist/seo/controllers/seo.controller.js

@@ -27,18 +27,20 @@ export function createSeoController({ api }, { t = (key) => key } = {}) {
     }
     async function regenerateSitemap(_required = {}, _optional = {}) {
         store.set({ patch: { saving: true, error: null, notice: null } });
+        // One exit after `finally`: returning from both try and catch left a fall-through nothing took.
+        let accepted = false;
         try {
             await api.regenerateSeoSitemap({});
             store.set({ patch: { notice: t('Sitemap regeneration accepted.') } });
-            return true;
+            accepted = true;
         }
         catch (error) {
             store.set({ patch: { error: describeSeoError({ error, fallback: t('failed to regenerate sitemap') }) } });
-            return false;
         }
         finally {
             store.set({ patch: { saving: false } });
         }
+        return accepted;
     }
     return {
         ...store, load, save, regenerateSitemap,

package/dist/seo/react/components/MediaRefField.d.ts

@@ -48,5 +48,5 @@ export interface MediaRefFieldProps {
      *  `useDialog` prop. Defaults to the real {@link useWiredMediaRefField}. */
     useField?: typeof useWiredMediaRefField;
 }
-export declare function MediaRefField({ locale, id, name, label, value, onChange, agentHandle: base, emptyHint, inherited, useField, }: MediaRefFieldProps, _optional?: Record<string, never>): import("react").JSX.Element;
+export declare function MediaRefField({ locale, id, name, label, value, onChange, agentHandle: base, emptyHint, inherited, useField, }: MediaRefFieldProps): import("react").JSX.Element;
 //# sourceMappingURL=MediaRefField.d.ts.map

package/dist/seo/react/components/MediaRefField.js

@@ -4,7 +4,7 @@ import { interpolate } from "@jini-ai/ui/i18n";
 import { MediaPickerBridge } from "./MediaPickerBridge.js";
 import { useSeoCopy } from "../hooks/SeoPorts.hooks.js";
 import { useWiredMediaRefField, useMediaRefPresentation, handleSpread } from "../hooks/MediaRefField.hooks.js";
-export function MediaRefField({ locale, id, name, label, value, onChange, agentHandle: base, emptyHint, inherited = false, useField = useWiredMediaRefField, }, _optional = {}) {
+export function MediaRefField({ locale, id, name, label, value, onChange, agentHandle: base, emptyHint, inherited = false, useField = useWiredMediaRefField, }) {
     const t = useSeoCopy();
     const { Picker = MediaPickerBridge } = useMediaRefPresentation({ value });
     const { pickerOpen, openPicker, closePicker, handleSelect, clear, previewUrl, file, accept, onPreviewLoad, onPreviewError } = useField({ value, onChange });
@@ -17,6 +17,23 @@ export function MediaRefField({ locale, id, name, label, value, onChange, agentH
        2026-10-15 (round 3): the text box is gone — for a library pick it only ever said a read-only
        "Selected image" ("i can't change it and looks useless"), so the row names the file instead and
        the picker is the one way in. The exact value still rides a hidden input for FormData saves. */
-    return (_jsxs("div", { className: "jini-field jini-media-ref-field", children: [_jsx("span", { className: "jini-field-label", id: labelId, children: label }), _jsxs("div", { className: "jini-media-ref-field-row", role: "group", "aria-labelledby": labelId, ...(base ? agentHandle({ handle: base }, { role: "region", label }) : {}), children: [file ? (_jsxs("span", { className: inherited ? "jini-media-ref-field-file jini-media-ref-field-file-inherited" : "jini-media-ref-field-file", children: [previewUrl ? _jsx("img", { className: "jini-media-ref-field-preview", src: previewUrl, alt: `${label} preview`, onLoad: onPreviewLoad, onError: onPreviewError }, previewUrl) : null, _jsx("span", { className: "jini-media-ref-field-name", title: file.name, children: inherited ? interpolate({ template: t({ locale: locale, key: inherited === 'content' ? "Using image from page content: {name}" : "Using site default: {name}", vars: { name: file.name } }), vars: { name: file.name } }) : file.name }), file.size && !inherited ? _jsx("span", { className: "jini-media-ref-field-size", children: file.size }) : null] })) : (emptyHint && _jsx("span", { className: "jini-media-ref-field-empty", children: emptyHint })), name ? _jsx("input", { type: "hidden", id: id, name: name, value: value }) : null, _jsxs("span", { className: "jini-media-ref-field-actions", children: [_jsx("button", { type: "button", className: "jini-btn jini-btn-secondary", onClick: openPicker, ...handleSpread({ ...(base === undefined ? {} : { base }), suffix: "choose", label: `Choose an image for: ${label}` }), children: t({ locale: locale, key: "Choose image" }) }), value && !inherited ? (_jsx("button", { type: "button", className: "jini-btn jini-btn-secondary", onClick: clear, ...handleSpread({ ...(base === undefined ? {} : { base }), suffix: "clear", label: `Remove the selected image for: ${label}` }), children: t({ locale: locale, key: "Remove" }) })) : null] })] }), pickerOpen ? (_jsx(Picker, { onSelect: handleSelect, onCancel: closePicker, accept: accept, agentHandle: base ? `${base}-dialog` : undefined })) : null] }));
+    return (_jsxs("div", { className: "jini-field jini-media-ref-field", children: [_jsx("span", { className: "jini-field-label", id: labelId, children: label }), _jsxs("div", { className: "jini-media-ref-field-row", role: "group", "aria-labelledby": labelId, ...(base ? agentHandle({ handle: base }, { role: "region", label }) : {}), children: [_jsx(MediaRefFile, { file: file, emptyHint: emptyHint, label: label, locale: locale, t: t, inherited: inherited, previewUrl: previewUrl, onPreviewLoad: onPreviewLoad, onPreviewError: onPreviewError }), name ? _jsx("input", { type: "hidden", id: id, name: name, value: value }) : null, _jsx(MediaRefActions, { label: label, locale: locale, t: t, base: base, value: value, inherited: inherited, openPicker: openPicker, clear: clear })] }), pickerOpen ? (_jsx(Picker, { onSelect: handleSelect, onCancel: closePicker, accept: accept, agentHandle: base ? `${base}-dialog` : undefined })) : null] }));
+}
+/** The chosen file: thumbnail, name (prefixed with its source when inherited) and, for an own
+ *  override, its pixel size. With no file, the field's empty hint (if any) takes the slot. */
+function MediaRefFile({ file, emptyHint, label, locale, t, inherited, previewUrl, onPreviewLoad, onPreviewError }) {
+    if (!file)
+        return emptyHint ? _jsx("span", { className: "jini-media-ref-field-empty", children: emptyHint }) : null;
+    return (_jsxs("span", { className: inherited ? "jini-media-ref-field-file jini-media-ref-field-file-inherited" : "jini-media-ref-field-file", children: [previewUrl ? _jsx("img", { className: "jini-media-ref-field-preview", src: previewUrl, alt: `${label} preview`, onLoad: onPreviewLoad, onError: onPreviewError }, previewUrl) : null, _jsx("span", { className: "jini-media-ref-field-name", title: file.name, children: inherited ? inheritedFileName({ name: file.name, inherited, locale, t }) : file.name }), file.size && !inherited ? _jsx("span", { className: "jini-media-ref-field-size", children: file.size }) : null] }));
+}
+/** "Using site default: {name}" or "Using image from page content: {name}", translated. */
+function inheritedFileName({ name, inherited, locale, t }, _optional = {}) {
+    const key = inherited === "content" ? "Using image from page content: {name}" : "Using site default: {name}";
+    return interpolate({ template: t({ locale, key, vars: { name } }), vars: { name } });
+}
+/** Choose (always) and Remove (only for an own value), grouped so they wrap as one unit. */
+function MediaRefActions({ label, locale, t, base, value, inherited, openPicker, clear }) {
+    const handleBase = base === undefined ? {} : { base };
+    return (_jsxs("span", { className: "jini-media-ref-field-actions", children: [_jsx("button", { type: "button", className: "jini-btn jini-btn-secondary", onClick: openPicker, ...handleSpread({ ...handleBase, suffix: "choose", label: `Choose an image for: ${label}` }), children: t({ locale, key: "Choose image" }) }), value && !inherited ? (_jsx("button", { type: "button", className: "jini-btn jini-btn-secondary", onClick: clear, ...handleSpread({ ...handleBase, suffix: "clear", label: `Remove the selected image for: ${label}` }), children: t({ locale, key: "Remove" }) })) : null] }));
 }
 //# sourceMappingURL=MediaRefField.js.map

package/dist/seo/react/hooks/MediaRefField.hooks.js

@@ -17,7 +17,9 @@ export function useMediaRefField({ value, onChange, api }, { t } = {}) {
     // One cached library read shared by every image field on the screen; only a library reference
     // needs it (a URL names itself), and a host without `listSeoMedia` falls back to the slug.
     const list = api.listSeoMedia;
-    const media = useFetchQuery({ key: SEO_KEYS.media, fetch: () => list ? list.call(api, {}) : Promise.resolve([]) }, { enabled: Boolean(list) && isStoredMediaRef({ value }) });
+    // `fetch` runs only while the query is enabled, which requires `list`: the fetch-query adapters
+    // never call a disabled read's fetch (not on mount, focus or prefix invalidation).
+    const media = useFetchQuery({ key: SEO_KEYS.media, fetch: () => list.call(api, {}) }, { enabled: Boolean(list) && isStoredMediaRef({ value }) });
     return {
         ...diagnostics,
         file: describeMediaRef({ value, media: media.data }, { width: naturalWidth, height: naturalHeight, t, extensionFor: extensionForMimeType }),

package/dist/seo/react/hooks/SeoPage.hooks.d.ts

@@ -29,7 +29,7 @@ export declare function useAnalyzePanel({ analysis }: {
     analysis: SeoEntryAnalysis;
 }, _optional?: Record<string, never>): {
     sortedIssues: import("../../../core/index.js").AdminSeoIssue[];
-    tone: "warning" | "success" | "failure";
+    tone: "failure" | "warning" | "success";
 };
 /** All seven defaults remain in one FormData submission; tabs never split this form. */
 export declare function useSeoDefaults({ save }: {